supporting subnet mask to specify exceptions